Information Flow in a Purpose-Oriented Access Control Model

In distributed applications, a group of multiple objects are cooperating to achieve some objectives. An object is modeled as a pair of data structure and operations. Each object is manipulated through an operation supported by the object and then the operation may further invoke operations of other objects, i.e. nested operations. The purpose-oriented access rules indicate what operation in each object can invoke operations of other objects. The information ow among the objects occur if the requests and responses of the operations carry some data. Only the purpose-oriented access rules which imply the legal information ow are allowed. In this paper, we discuss how to test the access rules if the information ow occurring in the nested invocation of the operations is legal.